PRIVACY POLICY FOR SAGOAI

Last updated: 4 September 2026

1. About this Privacy Policy

This Privacy Policy explains how WeNova KB (“WeNova”) processes personal data when you use SagoAI.

WeNova is the data controller for the processing of personal data described in this Privacy Policy.

SagoAI is designed to minimise the collection of personal data, particularly data relating to children.

2. What Data Do We Process?

The personal data we process depends on how you use SagoAI.

2.1 Account Information

When you create an account, we may process:

email address,
account ID,
authentication details and technical information required for login.

2.2 Information Required to Provide the Service

An email address is required to create and use an account. Choices and instructions relating to a story are required to the extent necessary to generate the requested content.

Other information you provide when you contact us is optional. If a required piece of information is not provided, the specific feature may not be available.

2.3 Content You Provide

When creating a story, you can make various selections and enter information into free-text fields.

This could be, for example:

a name of a fictional character,
theme,
environment,
interests,
properties,
other requests regarding the story.

Please do not enter real full names, addresses, schools, contact information, health information, or other sensitive personal data in the text fields.

We recommend using fictional names.

If you still leave personal data in a text field, the data may be treated as part of the request used to create the content.

2.4 Created and Saved Content

When you use SagoAI, we may process and store content associated with your account, including:

created stories,
illustrations,
narrations,
information needed to display and manage your saved content.

2.5 Purchases and Balance

In-app purchases are handled by the Apple App Store or Google Play, depending on the platform you're using.

We may access limited information necessary to verify and manage purchases, such as:

which product or package has been purchased,
transaction identifier,
information about story credits and audio tokens,
information required to restore or verify a purchase.

We do not have access to your full card or payment details.

2.6 Technical Information

When SagoAI is used, certain technical information may be processed to ensure that the service operates securely and correctly.

This can include, for example:

IP address,
time of requests,
app version,
device type and operating system,
technical errors and security logs.

We strive to limit such information to what is necessary for operation, troubleshooting, and security purposes.

2.7 Contacting Us

If you contact us by email or through our website, we process the contact details and other information that you choose to provide in your message.

2.8 Locally Stored App Data

SagoAI may store some data locally on your device to ensure the app functions properly and remembers your preferences, such as:

selected story profile,
reading position,
favorites,
most recently read stories,
activity results and progress,
app settings.

Local storage data is separate from data stored in your WeNova account.

3. How Do We Use the Data?

We process personal data when necessary to:

create and manage your account,
authenticate and log in the user,
create personalised stories, illustrations, and audio narration,
save and display content belonging to the account,
manage story credits and audio tokens,
verify purchases and the ability to restore purchases,
provide support,
maintain the security of the Service,
prevent fraud, abuse, and unauthorized access,
troubleshoot technical issues,
fulfill legal obligations.

We do not use personal data for targeted advertising to children.

4. App-Specific Features

4.1 Story Profiles and Children’s Data

Children can use parts of SagoAI under the supervision of an adult.

In the app, the adult can create local story profiles using preset characters and creative names.

Story profiles:

are not user accounts,
are not intended to contain the child's actual name,
do not store the child's actual age,
are not intended to contain any other personal data about the child,
are processed locally in the app and are not sent to WeNova as account information.

The age group selected when creating a story is used to tailor the reading level and content of the story. It is not intended to indicate or store the child's actual age.

SagoAI is not designed to collect children's personal data through story profiles.

4.2 Artificial Intelligence

SagoAI uses artificial intelligence to create personalised stories, illustrations, audio narration, and other content.

When you request the creation of such content, information required for the current generation can be sent to an AI provider.

Depending on the function you are using, this may include, for example:

your choices for the story,
selected reading level,
text you enter in the text box,
the story text when an illustration or audio narration is to be created.

Therefore, do not send sensitive personal information or other information that is not necessary to create the content.

AI providers only process the information necessary for the current service in accordance with our agreements and applicable data protection regulations.

WeNova does not use user stories content for targeted marketing.

4.3 Technical error monitoring

To detect crashes and technical errors in SagoAI, we use Sentry, a service provided by Functional Software, Inc. Sentry processes information on our behalf as a data processor.

When a technical error occurs, we may process information such as the time of the error, app version, operating system, device model, error message, and technical stack trace. This information is used only to troubleshoot errors, improve the stability of the app, and protect the service.

SagoAI is configured not to intentionally send account IDs, children’s names, story text, screenshots, audio, images, or complete network addresses to Sentry. Despite these safeguards, technical diagnostic information may, in exceptional cases, contain unexpected information from the context in which the error occurred.

The legal basis for this processing is our legitimate interest in providing a secure, stable, and functioning service. Error information is retained for the retention period configured for our Sentry account and is then deleted. Our Sentry project uses Sentry’s data storage region in Germany. Sentry and its subprocessors may process information in accordance with Sentry’s Data Processing Addendum and applicable safeguards for international data transfers.

SagoAI does not use Sentry for advertising, user profiling, or session recording.

4.4 Reporting stories

A signed-in adult user may report a story containing issues relating to, for example, text, images, audio, or inappropriate content.

When a report is submitted, we process the user’s account ID, the story and chapter concerned, the selected report category, any optional comment, the time of submission, the status of the report, and an administrative event log. This information is used to review the report, investigate the issue, and improve the safety and quality of the service.

For public stories, only the published story and the report information are reviewed.

If a user reports their own private story, separate and active consent is required before the report can be submitted. Once consent has been provided, an authorised administrator may access the current text, images, and audio belonging to that story to the extent necessary to handle the report. The story does not become public, and submitting a report does not create a separate archive of the story’s contents.

Only specifically authorised administrators may process reports. Access and status changes are logged. Media links used during the review are time-limited.

The legal basis for processing report information and reviewing public stories is our legitimate interest in handling errors, inappropriate content, and safety issues. Access to the contents of a private story is based on the user’s consent. Consent may be withdrawn by contacting us using the contact details provided in this policy. Withdrawal does not affect processing performed before consent was withdrawn.

Report information is retained until the user account is deleted or until we delete the information earlier. If only the story is deleted, the report category, comment, submission time, and administrative history may remain, but the administrator will no longer be able to access the story’s text, images, or audio. When the user account is deleted, the user’s reports and the associated administrative logs are deleted.

5. Legal Basis Under the GDPR

We only process personal data when there is a legal basis according to the GDPR.

Depending on the processing, we may rely on the following legal bases:

5.1 Performance of a Contract

When the processing is necessary to provide SagoAI and the features you request, such as:

account management,
creation and storage of stories,
audio narration,
management of story credits and audio tokens.

5.2 Legal Obligation

When we have to process or store information to comply with laws, such as accounting or other legal requirements.

5.3 Legitimate Interests

When processing is necessary for legitimate interests such as:

security,
prevention of fraud and abuse,
troubleshooting,
protection of our systems and user accounts.

We conduct an interest assessment when this legal basis is used.

5.4 Consent

If we implement a feature that requires consent under GDPR or other applicable laws, we will request this separately.

Such consent can be revoked at any time.

We do not rely on children's consent to create story profiles.

6. Service Providers and Sharing

We do not sell personal data.

We may share or allow third-party service providers to process your personal data when necessary to operate SagoAI.

This could be suppliers for, for example:

artificial intelligence, such as OpenAI,
database, authentication, and storage, such as Supabase,
operations and technical infrastructure,
Apple App Store and Google Play for in-app purchases,
security and technical troubleshooting,
communication and support.

When a supplier processes personal data on our behalf, the processing must comply with applicable data protection regulations and, where necessary, personal data processing agreements.

We require service providers that process personal data on our behalf to provide the same or equivalent protection for the data described in this Privacy Policy.

We may also disclose information if required by law or a binding decision from a competent authority.

7. Transfers Outside the EU/EEA

Some of our technical suppliers may process personal data in or from countries outside the EU/EEA, such as the USA.

When such a transfer occurs, it must be supported by the GDPR.

This can happen, for example, through:

decisions of the European Commission on adequate protection levels,
EU Commission Standard Contract Clauses (SCC),
other legal protection mechanisms in accordance with the GDPR.

If necessary, additional technical or organizational protective measures are also used.

You can contact us for more information on the protection measures used for transfers outside the EU/EEA or to request a copy of the relevant protection mechanisms.

8. How Long Do We Keep the Data?

We do not retain personal data longer than necessary for the purpose for which the data is processed.

8.1 Account Information

Account information is retained for as long as the account remains active or for as long as the information is required to administer the account.

8.2 Saved Stories, Illustrations and Narrations

Saved stories, illustrations and narrations are retained for as long as they remain in the user’s account or until the account is deleted.

8.3 Purchase and Transaction Information

Purchase and transaction information is retained for as long as necessary to manage purchases and to comply with applicable legal requirements.

8.4 Technical and Security Logs

Technical and security-related logs are retained for as long as necessary for security, operation and troubleshooting.

8.5 Support Communications

Support communications are retained for as long as necessary to handle and follow up on the matter or to comply with legal obligations.

When an account is deleted, personal data and content associated with the account are removed in accordance with our deletion procedures, with the exception of information that we are required to retain by law or need to retain in order to establish, enforce, or defend legal claims.

Information may remain in backups for a limited time before being overwritten according to our standard backup and deletion procedures.

9. Deletion of Account and Data

You can delete the account in the app by going to Profile → Adults → Account → Delete Account.

When the account is deleted, the account and associated stories, illustrations, and audio narrations will be removed, except for information that must be retained by law or may be retained under applicable data protection rules.

If SagoAI is made available via Google Play, WeNova will also provide an external web resource where users can request account deletion and deletion of associated data.

10. Children’s Privacy

SagoAI is developed with special consideration for children's privacy.

Therefore, we use a system where:

The account belongs to and is managed by an adult,
story profiles are created locally,
story profiles use managed entities and creative names,
the child's actual age does not need to be specified,
the selected age group is only used as the reading level for the story,
We urge users not to leave any real or sensitive personal information in the text fields.

If personal data about a child is entered into a text box, it may be treated as part of the requested AI generation and, if the content is saved, as part of the created story.

Therefore, use fictitious names and avoid information that could identify a child.

11. Profiling, Advertising and Automated Decision-Making

SagoAI does not display third-party ads, does not use advertising identifiers, and does not track users across other apps or websites.

SagoAI does not use personal data for automated decisions that have legal or similarly significant consequences for the user.

Choices such as age group, theme, or story style are used to create the content requested by the user, not to determine the child's identity or create a marketing profile.

SagoAI does not use personal data for targeted advertising.

12. Your Rights

According to the GDPR, depending on the circumstances, you have the right to:

receive information on how your personal data is processed,
access your personal data,
request the correction of incorrect information,
request the deletion of personal data,
request restriction of certain processing,
object to certain processing based on legitimate interest,
to obtain certain data in a structured and machine-readable format when the right to data portability applies,
revoke consent when processing is based on consent.

These rights are not absolute and may be limited by law in certain situations.

To exercise your rights, you can contact us at:

support@wenovastudio.se

We may need to verify your identity before processing a request to ensure that personal information is not provided to the wrong person.

You also have the right to lodge a complaint with the Data Protection Authority (IMY) if you believe that personal data is being processed in violation of data protection regulations.

13. Security

We use appropriate technical and organizational security measures to protect personal data against, for example:

unauthorized access,
unauthorized modification,
loss,
destruction,
unauthorized disclosure.

No digital service can guarantee complete security, but we are continuously working to limit risks and protect the information processed in SagoAI.

14. Changes to This Privacy Policy

We may update this privacy policy when SagoAI changes, when we introduce new features, or when legal requirements change.

The date at the top shows when the policy was last updated.

If a change is significant, we will inform the user appropriately when required by law.

The latest version is available in SagoAI and on our website.

15. Language Versions

This privacy policy may be available in multiple languages.

In the event of any differences or contradictions between the Swedish version and a translation, the Swedish version shall prevail.

16. Contact and Company Information

If you have any questions about this privacy policy or our processing of personal data, please contact WeNova:

Company: WeNova KB
Company registration number: 969804-6944
Registered office: Sollentuna, Sweden
Email: support@wenovastudio.se
Website: https://wenovastudio.se